Five South American countries outside the big regional regimes now set very different security and breach rules, from a 48 hour clock in Peru to no general data protection statute at all in Bolivia. Peru, Ecuador and Uruguay have comprehensive laws with breach notification duties, Paraguay enacted its first comprehensive law in November 2025 with a 24 month runway, and Bolivia still relies on constitutional and sectoral rules. This guide compares the security and breach duties that matter to security, privacy and engineering teams running systems that hold personal data from these countries. Countries are listed alphabetically. Argentina, Chile and Colombia have their own pages: see the Argentina Data Protection Law Guide, the Chile Data Protection Law Guide and the Colombia Data Protection Law Guide. For the global picture see the Global Privacy Regulatory Map.
Key takeaways
- Breach clocks differ by country. Ecuador counts five days to the regulator and three days to affected people, Paraguay will require 72 hours, Peru 48 hours, Uruguay 72 hours, and Bolivia has no general breach notification duty.
- Processor deadlines are explicit in Ecuador. A processor must tell the controller within two days under LOPDP Art. 43, and the 2026 SPDP technical norm keeps that two day limit, so contracts and runbooks need a processor escalation path.
- Peru's regulation is the newest operational rulebook. Supreme Decree 016-2024-JUS took effect on 30 March 2025 and phases in data protection officer appointments by company size through November 2028.
- Paraguay's law is enacted but not yet in force. Law 7593/2025 was promulgated and published on 27 November 2025 and takes effect 24 months after publication (Art. 57), so late 2027 is the planning date.
- Machine access is in scope everywhere. None of these laws distinguishes human from automated access: service accounts, API keys and AI agents that read personal data fall under the same security duty as staff.
Scope: who and what is covered
The four countries with comprehensive laws apply them to both public and private sectors. Uruguay and Peru also reach some foreign organisations: Uruguay's Decree 64/020 (Art. 1) covers processing linked to offering goods or services to people in Uruguay, analysing their behaviour, or using means located in the country such as data centres, and Peru's 2024 regulation requires controllers located outside Peru to name a representative in Peru.
| Country | Main instrument | Supervisory authority | Status (checked 14 November 2026) |
|---|---|---|---|
| Bolivia | No comprehensive law. Constitution Art. 130 (acción de protección de privacidad), telecom Supreme Decrees 1391 and 1793, Ley 1080 on digital citizenship | No dedicated authority; sector supervisors (finance, telecoms) within their fields | Status: no general statute in force as of November 2026; AGETIC presented a draft bill (anteproyecto) in 2024 |
| Ecuador | Ley Orgánica de Protección de Datos Personales (LOPDP), Registro Oficial Suplemento 459, 26 May 2021; General Regulation by Executive Decree 904 (November 2023) | Superintendencia de Protección de Datos Personales (SPDP) | Status: in force; sanctions regime applicable since 26 May 2023; SPDP breach notification technical norm SPDP-SPD-2026-0040-R issued in 2026 |
| Paraguay | Law 7593/2025 on Personal Data Protection, promulgated and published 27 November 2025 | Agencia Nacional de Protección de Datos Personales, a deconcentrated body within MITIC (Art. 34) | Status: enacted, not yet in force; effective 24 months after publication (Art. 57); regulations due within 24 months (Art. 60) |
| Peru | Ley 29733 on Personal Data Protection; new regulation by Supreme Decree 016-2024-JUS, published 30 November 2024 | Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights | Status: in force; new regulation effective 30 March 2025; DPO appointments phased to 30 November 2028 |
| Uruguay | Ley 18.331 (published 18 August 2008); Ley 19.670 Arts. 37 to 40; Decree 64/020 (published 21 February 2020) | Unidad Reguladora y de Control de Datos Personales (URCDP), within AGESIC (Ley 18.331 Art. 31) | Status: in force; EU adequacy decision in place and covered by the Commission's 15 January 2024 review |
Key obligations
Security measures
- Bolivia: no statutory security standard for personal data in general. Sector rules apply, and the telecom decrees require express written consent for use of personal data. The 2024 draft bill proposes physical, technical and administrative measures to protect confidentiality, integrity and availability.
- Ecuador: LOPDP Art. 37 makes controllers and processors apply the security principle, weighing data categories and volume, the state of the art, good practice and cost, assessing risk, and checking the effectiveness of measures on a continuing basis.
- Paraguay: Law 7593 Art. 16 requires controllers and processors to establish, implement, monitor and continuously improve security measures; the agency will set minimum technical standards.
- Peru: Ley 29733 requires security measures appropriate to the processing, and the 2024 regulation adds incident handling, representative and DPO duties. Digital incidents are also reported to the national digital security centre.
- Uruguay: Ley 18.331 Art. 10 requires the measures necessary to guarantee security and confidentiality. Decree 64/020 Art. 3 requires procedures to minimise impact to start within the first 24 hours after an incident is confirmed, and Arts. 8 and 9 require privacy by design and by default.
Breach notification compared
| Country | To the regulator | To affected people | Processor to controller | Source |
|---|---|---|---|---|
| Bolivia | No general duty | No general duty | Contractual only | Sector rules may apply |
| Ecuador | As soon as possible and at the latest within five days, to the SPDP and the telecoms regulator ARCOTEL, unless the breach is unlikely to pose a risk | Within three days of knowing of the risk, where there is a risk to rights and freedoms; public communication if individual notice is disproportionate | Within two days | LOPDP Arts. 43 and 46; SPDP-SPD-2026-0040-R |
| Paraguay | Within 72 hours of becoming aware | Where appropriate, within the same 72 hours | Set by regulation | Law 7593 Art. 17 (from entry into force) |
| Peru | Within 48 hours of becoming aware, even if resolved internally, where the incident meets the regulation's conditions | Within 48 hours, in plain language with mitigation measures, where other rights are affected | Contract and regulation | DS 016-2024-JUS |
| Uruguay | Within 72 hours, with the date, nature and data affected, then a detailed final report | In clear and simple language where rights are significantly affected | Immediately | Ley 19.670 Art. 38; Decree 64/020 Art. 4 |
Ecuador's 2026 technical norm routes notifications through the SPDP's online system and lists what a notice to data subjects must contain: the nature of the breach, the detection date or estimated period, measures taken and recommendations. The LOPDP counts its deadlines as a "término", which in Ecuadorian procedure usually means working days; confirm the counting with local counsel before you build the clock into a runbook. For other regimes see the Breach Notification Laws by Country Guide.
Data protection officers and impact assessments
| Country | DPO required when | Impact assessment |
|---|---|---|
| Bolivia | No general requirement | No general requirement |
| Ecuador | Public sector; regular and systematic monitoring due to volume, nature or purpose; large scale special category data (LOPDP Art. 48). Decree 904 requires independence and sets qualifications | Required for high-risk processing under the LOPDP |
| Paraguay | Cases to be defined by regulation (Art. 18) | Before high-risk processing; mandatory for automated profiling with legal effects, large scale sensitive or criminal data, and large scale monitoring of public areas (Art. 14) |
| Peru | Public entities; large volumes or many people affected; sensitive data; core business involving sensitive data. Deadlines from publication: over 2,300 UIT annual sales 30 November 2025, medium 30 November 2026, small 30 November 2027, micro 30 November 2028 | Recommended as good practice for high-risk processing, alongside the 2024 regulation's incident and DPO duties |
| Uruguay | Public entities; private entities whose main business is sensitive data; private entities processing data of more than 35,000 people (Decree 64/020 Art. 10). Notify the URCDP within 90 days of starting processing (Art. 14) | Before processing in listed cases such as large volumes or vulnerable groups (Decree 64/020 Art. 6) |
For method see the DPIA Guide.
International transfers
Uruguay's Ley 18.331 Art. 23 prohibits transfers to countries or international bodies without adequate protection, subject to listed exceptions, and Uruguay itself holds an EU adequacy decision. Ecuador, Paraguay and Peru regulate transfers in their laws; build transfer clauses and a transfer register into supplier onboarding rather than treating each country separately.
Timeline and current status
| Date | Event |
|---|---|
| 18 August 2008 | Uruguay: Ley 18.331 published |
| 21 February 2020 | Uruguay: Decree 64/020 published (breach, DPO, impact assessment, territorial scope) |
| 26 May 2021 | Ecuador: LOPDP published in Registro Oficial Suplemento 459 |
| 26 May 2023 | Ecuador: corrective measures and sanctions regime applicable (two years after publication) |
| November 2023 | Ecuador: General Regulation issued by Executive Decree 904 |
| 15 January 2024 | European Commission report on the first review of eleven adequacy decisions, including Uruguay |
| 30 November 2024 | Peru: Supreme Decree 016-2024-JUS published |
| 30 March 2025 | Peru: new regulation in force |
| 27 November 2025 | Paraguay: Law 7593/2025 promulgated and published |
| 2026 | Ecuador: SPDP breach notification technical norm SPDP-SPD-2026-0040-R |
| 30 November 2026 | Peru: DPO deadline for medium-sized companies |
| November 2027 (24 months after publication) | Paraguay: Law 7593 enters into force; regulations due by the same point |
Paraguay's regulations and Bolivia's draft bill are the two moving parts to watch. Treat Paraguay's 72 hour clock as the design target now, since the regulation will fill in conditions rather than relax the statute.
Enforcement and penalties
| Country | Sanctions |
|---|---|
| Bolivia | No general data protection sanctions regime; constitutional action and sector sanctions apply |
| Ecuador | Private sector and public companies: minor infringements 0.1% to 0.7% of turnover (Art. 71), serious infringements 0.7% to 1% of turnover (Art. 72). Public officials: 1 to 10 and 10 to 20 unified basic salaries. Failure to notify the SPDP or data subjects of a breach is a serious infringement |
| Paraguay | Warning; fines of 20 to 2,500 minimum daily wages, up to 5,000 for sensitive data and 10,000 for sensitive data of children and adolescents; suspension of processing (Art. 46) |
| Peru | Three-tier scheme in Ley 29733 with fines up to 100 UIT; failing to notify a security incident is a serious infringement fined 5 to 50 UIT |
| Uruguay | Observation, warning, fine of up to 500,000 indexed units (UI), five day suspension of a database, closure (Ley 18.331 Art. 35) |
Ecuador's percentage fines are the largest exposure for a large company. Uruguay's database suspension and closure powers matter more operationally than the fine cap.
What it means for AI agents and non-human identities
All five frameworks attach duties to the processing, not to who or what performs it. An API key used by an integration, a service account behind a reporting job, or an AI agent with a retrieval connector is a route to personal data that the security duty covers.
- Inventory machine access to personal data: list every service account, token and agent identity that reads tables or stores holding data from these countries. Uruguay's 35,000 person DPO threshold and Paraguay's impact assessment triggers both depend on knowing processing volumes, which machine identities often drive. See NHI Inventory Reconciliation.
- Make leaked credentials a breach trigger: a leaked key with read access to personal data can start the clock (48 hours in Peru, 72 in Uruguay) once you know of it. Your secret exposure runbook should hand off to the privacy breach assessment, not stop at rotation. See Leaked secret breaches.
- Profiling by agents: Paraguay Art. 14 makes impact assessments mandatory for systematic automated profiling with legal effects. AI agents that score or decide on individuals need that assessment before launch.
- Processor chains: SaaS and AI providers acting as processors must meet Ecuador's two day and Uruguay's immediate notice duties. Put these into contracts with named contacts.
- Logs as evidence: Uruguay's final report and Ecuador's notice content both need the date and nature of the breach. Keep authentication and data access logs for machine identities long enough to reconstruct what was read.
Compliance steps
- Map data by country: tag systems holding personal data of residents of each country, including logs and analytics copies.
- Build one breach clock with country branches: start the timer at awareness; route to Peru (48 hours), Paraguay (72 hours once in force), Uruguay (72 hours plus final report) and Ecuador (five days to SPDP and ARCOTEL, three days to people, two days from processors). Test it in a tabletop with a leaked API key scenario.
- Appoint DPOs where triggered: check Peru's size-based deadline, Uruguay's 35,000 person threshold and Ecuador's Art. 48 cases; register with the URCDP within 90 days where needed.
- Run impact assessments: before high-risk processing in Uruguay and Ecuador now, and Paraguay from entry into force, including AI and profiling use cases.
- Update processor contracts: notification deadlines, assistance with regulator reports, deletion at end of contract and transfer terms.
- Harden access: least privilege, MFA for people, short-lived credentials and owners for machine identities, quarterly access reviews.
- Name a representative in Peru: if you are outside Peru and in scope, publish the representative in your privacy notice or tell the ANPD.
- Monitor Bolivia and Paraguay: track the Bolivian bill and Paraguay's regulations and refresh this mapping each quarter.
Practitioner checklist
- Data inventory tagged by country for Bolivia, Ecuador, Paraguay, Peru and Uruguay.
- Breach runbook with 48 hour, 72 hour and five day branches and a two day processor path.
- Peru DPO appointed by your size deadline and representative named if you are abroad.
- Uruguay DPO notified to the URCDP where you exceed 35,000 people or process sensitive data as core business.
- Impact assessments on file for high-risk and automated profiling processing.
- Processor contracts carry notification deadlines and evidence duties.
- Every service account, API key and AI agent touching personal data has an owner and is reviewed.
- Credential leak response hands over to privacy breach assessment.
- Paraguay readiness plan dated against November 2027.
Standards and references
- Government of Ecuador: Ley Orgánica de Protección de Datos Personales
- BACN Paraguay: Ley N° 7593/2025 de Protección de Datos Personales
- IMPO Uruguay: Ley 18.331
- IMPO Uruguay: Decreto 64/020
- El Peruano: new regulation of Ley 29733 in force from 31 March
- European Commission: Adequacy decisions
- AGETIC Bolivia: Anteproyecto de Ley de Protección de Datos Personales
- NMS Law: SPDP breach notification technical norm
This guide summarises the data protection laws of Bolivia, Ecuador, Paraguay, Peru and Uruguay as published by official sources at the date shown, and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Argentina Data Protection Law Guide · Chile Data Protection Law Guide · Colombia Data Protection Law Guide · Breach Notification Laws by Country Guide